---
title: Hunt: China-aligned SlippyNunchucks hijacked DNS for Sogou Input Method's plain-HTTP config requests to plant the DarkVigil backdoor (CVE-2026-120422) | ctxsec
url: https://ctxsec.com/items/hunt-eset-slippynunchucks-sogou-ime-dns-hijack-darkvigil-cve-2026-120422
description: "ESET says SlippyNunchucks, a China-aligned espionage group, has since July 1 been answering a plain-HTTP request from Sogou Input Method's SGTool.exe (config.pinyin.sogou.com/api/brandScd/getBrandScd.php) with a malicious config by controlling the victims' DNS. The config told SGTool to download a signed Adobe binary saved as SogouComMgr.exe plus a malicious libcef.dll (DarkVigil), which then ran through Sogou's own component-loading workflow. Victims were in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. Where the DNS tampering happens (router, implant or ISP) is unknown. Tencent moved the requests to HTTPS with certificate pinning in version 16.10."
status: "confirmed research (ESET Research / WeLiveSecurity, Nov 4; Tencent fix in Sogou Input Method 16.10)"
published: 2026-11-04
---

> ESET says SlippyNunchucks, a China-aligned espionage group, has since July 1 been answering a plain-HTTP request from Sogou Input Method's SGTool.exe (config.pinyin.sogou.com/api/brandScd/getBrandScd.php) with a malicious config by controlling the victims' DNS. The config told SGTool to download a signed Adobe binary saved as SogouComMgr.exe plus a malicious libcef.dll (DarkVigil), which then ran through Sogou's own component-loading workflow. Victims were in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. Where the DNS tampering happens (router, implant or ISP) is unknown. Tencent moved the requests to HTTPS with certificate pinning in version 16.10.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-eset-slippynunchucks-sogou-ime-dns-hijack-darkvigil-cve-2026-120422.md)

confirmed research (ESET Research / WeLiveSecurity, Nov 4; Tencent fix in Sogou Input Method 16.10)

2026-11-04

### Hunt: China-aligned SlippyNunchucks hijacked DNS for Sogou Input Method's plain-HTTP config requests to plant the DarkVigil backdoor (CVE-2026-120422)

- **Update:** Sogou Input Method for Windows to 16.10 or later.
- **Endpoint:** look for `libcef.dll` or an Adobe-signed binary under `\SogouInput\Components\` or `\Components\biz_center\<version>\`, and a `SogouComMgr.exe` whose signer is Adobe rather than Sogou/Tencent. DarkVigil stores plugins in `HKCU\Software\Microsoft\IME\`.
- **Network:** `config.pinyin.sogou[.]com` resolving to anything other than Sogou's infrastructure, especially 47.239.250[.]102, 47.237.122[.]175 or 47.236.254[.]159; domains `sogou-cdn[.]com`, `dev.soft-png-cdn[.]com`, `blog.wangmengfun[.]top`, `update.mssproxy[.]net`, `img.fusfun[.]top`; 47.86.15[.]162. DarkVigil's C2 uses the DMTP protocol (messages start with the bytes `dm`).
- **Hashes (SHA-1):** `8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23` (libcef.dll), `3E16BA611782AF6E45576D390488D28FD676BADE`. Full list in ESET's GitHub.

Sources: [ESET WeLiveSecurity: SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (Nov 4)](https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/)